Investigate the ETW provider

[assarbad]

{9C642431-C036-7958-4B0E-FE163528322B} aka GUID_MSVC_PROVIDER

• logman.exe query providers doesn't list it (nor does wevtutil) ... seems to have no name ([System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession.GetProviderNames()), just a GUID
  • I reckon this means we would have to synthesize the part that allows us to make messages readable ... or find it (odds are they aren't publicly available anywhere)
• keyword 0x20020 == VC_LINK_Switch_defaultlib
• keyword 0x20067 == VC_LINK_Switch_nodefaultlib

  • xperf -start link -on 9C642431-C036-7958-4B0E-FE163528322B:0x20067:0xffffffff -f .\link.exe.etl
    xperf -stop link
    

    failing (not with an error, but no events in the resulting trace) suggests that somehow it needs to be enabled - current working theory is that this is closely related to Investigate Microsoft_VisualCpp_ToolsEnableBits #4 ...

Pavel's ETWExplorer or Elias' WEPExplorer may be of help.

PS: Getting Provider Metadata